My CA can create "twin-me" cert that can be used in future to impersonate me in an active, targeted attack.

Heartbleed can obtain my keys that can be used to passively decode traffic that they recorded a long time ago; and they can do that as random untargeted fishing on scale.